The signature of the token can be validated by token validators to verify the identity of the issuer. Ozone manager issues delegation token and block tokens for users or client applications authenticated with Kerberos. Like Hadoop delegation tokens, Ozone security token has a token identifier along with a signed signature from the issuer. Correspondingly, Ozone clients must provide either a valid Kerberos ticket or security tokens to access Ozone services such as Ozone Manager for metadata and Datanode for read/write blocks.
More details on the OM/SCM/Datanode Kerberos configuration can be found in Apache Hadoop Ozone documents. Each service must be configured with valid Kerberos Principal Name and keytab file, which will be used by the service to login upon the start of the service in secure mode.
Kerberos-based AuthenticationĪs shown in Figure 1 below, Service components including OM (Ozone Manager), SCM (Storage Container Manager) and Datandoes are all authenticated with each other via Kerberos. Ozone is compatible with Apache Hadoop security architecture, supporting strong authentication using Kerberos as well as security tokens. We will cover the Authentication part in this blog along with the remaining in the followup ones.Īuthentication is the process of recognizing a user’s identity for Ozone components.
Security can be classified into four building blocks: Authentication, Authorization, Auditing and Encryption. It has also been included as a tech preview in Cloudera’s CDP Data Center 7.0 release. Ozone security has been added since the Apache Hadoop Ozone 0.4.0 release with contributions from the communities. With the growing data footprint and multifaceted workloads that need collaboration between various groups, data security is of utmost importance. This makes Ozone easily consumable by different kinds of big data workloads such as data warehouse on Apache Hive, data ingestion with Apache Nifi, streaming with Apache Spark/Flink and machine learning with Tensorflow. Ozone supports rich APIs such as Amazon S3, Kubernetes CSI as well as native Hadoop File System APIs. It can manage billions of small and large files that are difficult to handle by other distributed file systems. Apache Ozone is a distributed object store built on top of Hadoop Distributed Data Store service.
0 kommentar(er)
